[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
) O6 x# R* S* I
Keyboard Interrupt Hook using I/O APIC
& p, u% p0 r% d6 P
By: chpie
1 s3 e& T/ P4 I$ _. D6 l( xKeyboard Interrupt Hooking by manipulating the I/O APIC
tested on the winXP, Pentium D Hyper-threading Enabled.


Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
& d: z% Y7 F, \+ _; R2 wthe interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.

6 l* p! N  j8 L1 e, K6 U2 ]- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.
1 o. Q& u; O- C1 N: R
Flow ::
* j& y! p6 g1 w% [# ^
1. IRQ 1 Assert !!!
0 l3 J7 m/ H- X5 _2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
' m4 e% ~, ~4 a4. Local APIC pass the signal to the processor for its delivery mode ExtINT
, x( Z" N( q- v. g2 ^* G* ?) x5. A processor receives the signal.
8 t6 y2 {. M3 _4 u+ _" C6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
0 @' D/ m9 \, d9 r  c  J9. The I/O APIC delivers the signal to the 8259a compatible PIC
9 @5 I6 p2 ^# d" h3 b) S( x3 b, u; }! vfor ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
6 {3 b  @' y/ G3 [% s11. The processor execute 2 bytes sended.
12. our interrupt handler executed.
7 Q" O6 A$ F- L& x: b
* ~- g9 k% u1 l, _* H% B
sourcecode and binary are available on the
http://www.rootkit.com/vault/chpie/apic_keyboard.zip